PyShark
PyShark is a wrapper for the Wireshark CLI (TShark), so we can have all Wireshark decoders in the PyShark. We can use PyShark to sniff an interface or we can analyze the pcap
files.
Getting ready
When using this module, make sure to install Wireshark on your system and install pyshark
using the pip
command:
pip3 install pyshark
Also, make sure you have installed TShark on your machine. TShark is the terminal-based Wireshark, which is used by PyShark for packet capturing functions.
Note
Learn more about TShark here: https://www.wireshark.org/docs/wsug_html_chunked/AppToolstshark.html
How to do it...
Lets try PyShark with some examples. Make sure to install TShark in your system.
- For a better understanding, we can use the Python interactive terminal and go through the functions of PyShark. Please note that these commands can also be included in the scripts. The only dependency is TShark.
- Import the
pyshark
module:
>>> import pyshark
- Now load the
pcap
file topyshark
:
>>> cap ...